TRACE: Trajectory Aware Reasoning for Multi-Turn Adversarial Conversation Evaluation

2026-08-16

AI Summary

This study addresses the challenges of insufficient reasoning and excessive refusal in defending large language models against multi-turn jailbreak attacks by proposing a trajectory-aware structured reasoning framework. The method evaluates user intent through the identification of conversational manipulation cues and jointly optimizes safety and helpfulness via supervised fine-tuning, Group Relative Policy Optimization (GRPO), and a multi-component reward strategy. Experimental results demonstrate that this framework reduces the average attack success rate to 14.5% while maintaining a 93.3% compliance rate for benign requests. Consequently, the proposed approach significantly enhances defense robustness and increases adversarial costs without compromising model utility, effectively balancing safety alignment with practical usability in multi-turn interaction scenarios.

Abstract

Multi-turn jailbreak attacks have emerged as a critical safety threat to LLMs, as harmful objectives are decomposed across a sequence of apparently benign turns to bypass guardrails. Existing defenses lack the reasoning capacity to identify evolving manipulation patterns, often trading helpfulness for safety by over-refusing benign requests related to sensitive topics. We introduce Trace, a multi-turn defense with trajectory-aware structured reasoning. Before generating each response, the model identifies manipulation cues from the trajectory, evaluates both the benign and adversarial interpretations of user intent, assigns a jailbreak score, and commits to an action: Allow, Caution, or Decline. We curate 4k multi-turn adversarial conversations from five attack frameworks, pair them with 2.4k benign dialogs, and 600 sensitive-but-benign conversations. We train Llama-3.1-8B-Instruct with SFT and GRPO under a multi-component reward that jointly optimizes helpfulness on benign prompts and robustness against jailbreak attempts. Across seven multi-turn attack benchmarks, Trace attains an average attack success rate (ASR) of 14.5% against 31.4% for the strongest baseline and 74.9% for the undefended target, while significantly raising the attacker effort required per successful jailbreak. Trace also balances usability and safety, achieving a 93.3% average compliance on over-refusal benchmarks.

Problem

• Multi-turn jailbreak attacks
• LLM safety
• Over-refusal
• Adversarial conversation evaluation

Innovation

• Trajectory-Aware Reasoning
• Multi-Turn Jailbreak Defense
• GRPO
• Structured Reasoning
• Safety-Helpfulness Trade-off